MALICIOUS — 5bff2676d397512b23d016bc94a6ad367f3174d42d94ee7a5597a3feedbf4f90

MALICIOUS — 5bff2676d397512b23d016bc94a6ad367f3174d42d94ee7a5597a3feedbf4f90 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 3 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 5bff2676d397512b23d016bc94a6ad367f3174d42d94ee7a5597a3feedbf4f90
• SHA-1: 0b724c7ef27d11f5748982ee698977277e528779
• MD5: 710f1300e9f4c558856c62168f6567c8
• ssdeep: 1536:sWVUJebAij5RFUvBrAlRGsTUfuz+aIzbN2oZOK5chV2ueGyWHpOvTWMdWO:5VjdqsTvsbN2osK5m2JGyv/oO
• TLSH: T16C36E1F710E7DD2C6D1F8F039EAB12AE928DE3448A93E5A1508C466D757C5BFA900D40
• Submitted as: 5bff2676d397512b23d016bc94a6ad367f3174d42d94ee7a5597a3feedbf4f90
• File type: pdf · Size: 64620 bytes
• Verdict: malicious (99/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://giverny-bkk.com/upload/files/baxupujag.pdf - network signal, weight 0.70, confidence 0.80
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 10 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://markfarolaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/58309558412.pdf, https://fallsplat.se/bildbank/file/rixabe.pdf, http://vibrobreaker.com/files/files/donaxoworaxinegobakixix.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1174 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• 23.40.52.85
• 172.66.2.5 US · San Francisco · AS13335 Cloudflare, Inc.
• 23.11.37.157

Dropped files

• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=how+to+download+faster+on+android
• http://markfarolaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/58309558412.pdf
• https://fallsplat.se/bildbank/file/rixabe.pdf
• http://vibrobreaker.com/files/files/donaxoworaxinegobakixix.pdf
• https://minipowerpack.net/upload/files/27038728393.pdf
• http://15881588.com/ckupload/files/tajotarifogepasagazigukas.pdf
• https://clubforeducation.com/FCKeditor/userfiles/file/wagudibepib.pdf
• https://polenhosting.com/calisma2/files/uploads/zunamexabejewe.pdf
• https://giverny-bkk.com/upload/files/baxupujag.pdf
• http://whkmradio.com/userfiles/file/51618528816.pdf
• https://marblobathware.ph/app/webroot/img/files/nezemuwoninuxaj.pdf
• http://dyneco.kr/userData/board/file/90187426414.pdf
• https://eingangrad.ch/userfiles/files/14434508289.pdf
• https://gresathouse.com/wp-content/plugins/super-forms/uploads/php/files/2e18cdeaf95836ef215baf87df9216c2/seruxiledo.pdf
• https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/16135a57e1be8b---5206098523.pdf
• http://www.pes.edu.mn/ckfinder/userfiles/files/vixuremulakosula.pdf
• https://booking-news.hkdnracing.com/webroot/editor-uploads/files/63079570454.pdf
• http://futurepoolandspa.com/ckfinder/userfiles/files/88418254460.pdf
• http://rosabaum.de/web/editor/files/37737992598.pdf
• http://candleelectricals.com/uploaded_files/userfiles/files/sakorowipugafejapagapanuw.pdf
• https://adikketiga.com/contents/files/76217041750.pdf
• https://gianlucabruno.it/dati/upload/file/85876178136.pdf
• https://ladychief.com/wp-content/plugins/super-forms/uploads/php/files/9ffba3959da2c14ff99a301bf46e4808/fefojatekiba.pdf
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• feedproxy.google.com
• markfarolaw.com
• fallsplat.se
• vibrobreaker.com
• minipowerpack.net
• 15881588.com
• clubforeducation.com
• polenhosting.com
• giverny-bkk.com
• whkmradio.com
• dyneco.kr
• eingangrad.ch
• gresathouse.com
• www.diktu.com
• booking-news.hkdnracing.com
• futurepoolandspa.com
• rosabaum.de
• candleelectricals.com
• adikketiga.com
• gianlucabruno.it
• ladychief.com
• marblobathware.ph
• www.pes.edu.mn
• x2.c.lencr.org
• ye.c.lencr.org

Embedded IP addresses

• 172.172.255.216
• 172.66.2.5
• 52.110.12.37
• 4.230.171.124
• 51.132.193.104
• 135.233.95.144
• 20.247.184.142
• 92.223.78.30
• 51.116.246.106
• 20.89.1.9

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report